A five-person Edinburgh cybersecurity consultancy was losing 24 hours every week to compliance admin — writing assessment reports, setting up project files, and drafting proposals that followed the same structure every time. That admin was capping the firm at twelve assessments a month, turning away work they could otherwise have taken. Three AI agents changed the maths: 61% more assessments, 21 hours recovered weekly, £75 a month to run.
The Compliance Admin Bottleneck in Cybersecurity
The firm specialised in SME compliance work: Cyber Essentials, Cyber Essentials Plus, and ISO 27001 pre-assessment gap analysis for businesses across Scotland and the north of England. The technical side of the work — assessing client systems, identifying exposures, advising on remediation — required their consultants. The admin that surrounded that work did not.
Before each assessment: three to four hours setting up the project. Reviewing the client's scope questionnaire, extracting the key parameters, populating the assessment framework document, creating the client folder structure, generating the timeline, and sending the pre-assessment checklist. Every time. For every client. Following the same steps.
After each assessment: five to six hours writing the compliance report. Taking structured notes from the assessment itself and turning them into a formatted deliverable — executive summary, findings by category, risk rating per finding, recommended actions, and a certification readiness score. The format varied slightly by standard (Cyber Essentials, Cyber Essentials Plus, ISO 27001 gap analysis), but the structure was consistent enough that the consultants described writing the reports as "filling in the same template with different data each time."
On top of that: two to three hours per inbound enquiry writing a proposal. Scoping the work, setting the timeline, pricing the engagement, formatting the document, and sending it — for each new prospect, from scratch.
Total weekly admin drain across the team: 24 hours. Twelve assessments a month was the ceiling — not because the consultants couldn't do the work, but because the surrounding admin was consuming the time they'd need to take on more.
We weren't turning down work because we lacked the expertise. We were turning it down because we didn't have the hours to set up and document the engagements we already had. The assessment itself takes a day. The admin around it was taking another day on top.
— Principal Consultant, Edinburgh Cybersecurity Practice
The Three Agents They Built
The build took four weeks from initial scoping to all three agents running in production. The work was done in n8n, hosted on a low-cost VPS, using Claude as the underlying language model for report and proposal generation. No custom development was required — the entire system runs on configurable workflow nodes.
Agent 1: The Assessment Intake Agent. When a new assessment is confirmed, the client is sent a scope questionnaire — a structured form covering system architecture, user counts, data types handled, cloud services in use, and current security controls. When the completed form is returned, the Intake Agent reads it automatically, extracts the key parameters, generates the assessment framework document pre-populated with the client's environment, creates the project folder in the document management system, populates the project management tool with the standard task list and timeline, and emails the pre-assessment checklist to the client contact. From form submission to completed project setup: under four minutes. Previously: three to four hours.
Agent 2: The Compliance Report Agent. Each assessment produces a set of structured findings, recorded by the consultant in a standardised notes template during the assessment itself. When the template is saved to the client folder, the Report Agent triggers automatically. It reads the findings, identifies the applicable compliance standard from the project metadata, selects the correct report template, generates the full deliverable — executive summary, findings categorised by domain, risk rating per finding, recommended remediation actions, and certification readiness score — and saves the draft to the client folder, flagging it for consultant review. Review and edit time for a well-executed assessment: twenty to thirty minutes. Previously: five to six hours.
Agent 3: The Proposal Agent. When an inbound enquiry arrives — via the website contact form or email — it triggers the Proposal Agent. The agent reads the prospect's message, extracts the stated requirements (business size, sector, compliance standard needed, rough timeline), generates a scoped proposal with accurate pricing based on the firm's standard rate card and scope parameters, and emails it to the relevant consultant for review before sending. First-draft proposal ready in under three minutes. Human review and send: fifteen minutes. Previously: two to three hours per proposal.
What Each Agent Actually Does, Step by Step
The technical architecture is straightforward. All three agents sit inside a single n8n instance. They share the same connection to the client document management system (SharePoint), the project management tool (ClickUp), and the email account. The LLM calls go to Claude via the Anthropic API. Each agent is a separate workflow — they don't interfere with each other and can run simultaneously.
The Intake Agent is triggered by a webhook from the scope questionnaire form. It runs a structured extraction prompt against the submitted data, then uses the outputs to populate three downstream actions: document generation (the assessment framework), folder creation (SharePoint), and task creation (ClickUp). It sends one confirmation email to the client automatically.
The Report Agent is triggered by a file-created event when the consultant saves their completed findings template. It identifies the compliance standard from the project metadata, loads the appropriate report schema into the prompt, generates the full report, and saves the output as a Word document in the client folder. It sends a Slack message to the lead consultant confirming the draft is ready for review.
The Proposal Agent is triggered by either the contact form webhook or a specific email label applied manually when an enquiry arrives by direct email. It extracts scope, size, and standard from the enquiry, matches against the rate card embedded in the system prompt, generates a formatted proposal in Word, and drafts the covering email — saved as a draft, not sent automatically. The consultant reviews, edits if needed, and sends with one click. For a deeper look at how to build proposal automation for service businesses, see our AI proposal writer guide.
The Results After 90 Days
Ninety days after all three agents went live, the numbers were clear:
- Assessment capacity: 12 per month → 19–20 per month. A 61% increase in throughput with the same five-person team. The additional capacity came entirely from time recovered — the consultants were no longer spending a full day on admin for every assessment they completed.
- 21 hours recovered per week. Across the team, the intake setup, report writing, and proposal work that previously consumed 24 hours now requires three hours of human oversight — reviewing agent outputs, making edits, and approving sends.
- Proposal response time: 48 hours → under 4 hours. The faster response rate improved conversion from enquiry to engagement on inbound leads. Prospects who received a proposal within hours were measurably more likely to progress to a call.
- Report quality consistency improved. Consultant-reviewed reports from the agent showed fewer formatting errors and more consistent structure than fully manual reports — because the agent applied the same template precisely every time, with no end-of-day fatigue affecting the output.
The firm took on seven additional assessments in the first full month the agents were running. At their average engagement fee of £1,800 for Cyber Essentials Plus work, that represented £12,600 of additional revenue capacity in month one alone. They're on track to hire a sixth consultant — not to replace the admin the agents now handle, but to do the technical assessment work the new capacity has created demand for. That's the right reason to hire: for the work that genuinely needs a person.
What It Actually Cost
The build was completed over four weeks. The all-in cost breaks down as follows:
- Build and configuration: one-off cost
- n8n self-hosted (VPS): £12/month
- Anthropic API (Claude): £38–£50/month at current assessment volume
- Miscellaneous (SharePoint API access, ClickUp integration): £13/month
- Total monthly running cost: approximately £75/month
The payback period on the build cost was six weeks. At that point, the additional revenue generated by the capacity increase exceeded the cost of building the system. The agents now run with no meaningful ongoing maintenance — the firm reviews the prompt for the Report Agent quarterly to account for any standard updates from NCSC on Cyber Essentials requirements.
For the technical approach to keeping agent costs this low, the AI agent cost optimisation guide covers the caching and routing strategies that keep API spend flat even as assessment volume grows. For a look at how to test agent outputs before going live with client deliverables, the evaluation framework post covers the golden-dataset approach the firm used for the Report Agent — running it against fifteen completed historical assessments before deploying it on live client work.
If you run a compliance, risk, or technical consultancy and want to see what a similar build would look like for your assessment and reporting workflow, book a free 30-minute call. We'll map your current process, identify the highest-value automation targets, and give you a clear picture of what the build would cost and recover.